GreyEnergy

GreyEnergy is a type of malware, or malicious software, designed to exploit and damage computer systems. It is believed to have been used in attacks on Ukraine's power grid in 2018 by the Russia-linked Advanced Persistent Threat (APT) group, Sandworm. Security firm WithSecure has identified overlaps between GreyEnergy and another malware known as Kapeka, suggesting that they might be related. Similarly, conceptual similarities were found between GreyEnergy and its probable predecessor, BlackEnergy, which was also associated with Sandworm's cyber-attacks. The research suggests that Kapeka could be a successor to GreyEnergy, following a pattern of malware evolution within Sandworm's arsenal. Both GreyEnergy and Kapeka consist of a dropper component with an embedded main backdoor, allowing unauthorized access to infected systems. This speculation is further supported by the discovery of overlaps between Kapeka and the Prestige ransomware attacks, attributed to Sandworm, which targeted Ukraine in 2022. In conclusion, there is strong evidence pointing towards a connection between Kapeka, GreyEnergy, and the Sandworm APT group. While the two malware samples do not share the same source code, their conceptual overlaps and shared usage patterns suggest a lineage of development. This finding underscores the evolving threat posed by Sandworm and the importance of continued vigilance and research in cybersecurity.